RustFS Authorization Bypass via s3:GetObject Misuse

Executive Summary

CVE-2026-73265 is a vulnerability in RustFS, a distributed object storage system. It involves incorrect authorization checks when handling S3 requests with an explicit versionId parameter. RustFS authorizes versioned reads using s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to access known historical object content.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if RustFS versions prior to 1.0.0-beta.11 are running and verifying authorization logic for versioned object reads. Inspect logs for requests with versionId parameters and check if s3:GetObject permissions are incorrectly granting access to historical versions. No specific commands are provided in the resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized disclosure of historical object content to principals authorized only for s3:GetObject but not s3:GetObjectVersion. It also enables copying of disclosed historical content to authorized destinations via CopyObject or UploadPartCopy operations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.11 or later immediately. Review and update IAM policies to ensure s3:GetObjectVersion permissions are explicitly required for versioned reads. Remove any permissive policy mappings between s3:GetObjectVersion and s3:GetObject.

Useful 0 Not Useful 0